Guides
ProductDeveloper
Guides
ProductDeveloper

Troubleshoot Virtual Appliances

Suggest Edits

Table of Contents

Reset a Virtual Appliance's Password

If you forget a virtual appliance's (VA’s) password, you can reset it through the Sites and Active Directory page.

  1. Navigate to Deployments > Configuration > Sites and Active Directories.
1081
  1. Hover over a VA listing and click the Reset Password icon.
    Note: The Reset Password icon only appears when you hover over a VA listing.
1040
  1. Click Reset to confirm that you want Umbrella to generate a new password for the VA.
    Note: It can take up to 15 minutes for the password to be reset.
440
  1. Click Download to retrieve the reset password.
1083

Umbrella lists a new password in the Virtual Appliance Components section of the Download Components modal.

459

Use Configuration Mode to Troubleshoot

The virtual appliance (VA) allows basic troubleshooting commands to be executed using the Configuration Mode. See Virtual Appliance Commands for a complete list of commands supported by the VA.

  1. To enter the Configuration Mode, on the VA console, press Ctrl+B.
    You can also enter the Configuration Mode by initiating an SSH connection to the VA.
1592
  1. To view a list of supported commands in the restricted shell, enter help.
  2. To return to the VA console, type exit.

If the VA console crashes, the VA automatically enters the restricted shell. In this case, contact support by raising a support ticket after enabling the debug session. For more information on how to enable the debug session, see Establish a Debug Session on the VA.

Establish a Debug Session on the VA

If you have raised a support ticket with Umbrella for any VA-related issues, you need to enable the debug user login on the Umbrella VA, using the vmuser enable command. After enabling the debug user login, run the vmuser show command to view the Passphrase. You have to share this Passphrase with the Cisco support team.

Here is a sample output of the config vmuser enable command:

$ config vmuser enable 10

VMuser debugging is :- ENABLED

Expires :- Wed Jun 14 15:47:04 2023

Passphrase :- ZEQ37NZJ

Here is a sample output of the config vmuser show command:

$ config vmuser show

VMuser debugging is :- ENABLED

Expires :- Wed Jun 14 15:47:04 2023

Passphrase :- ZEQ37NZJ

Note: The debugging on the VA is conducted by the Cisco support team.

After the issue is resolved, you can disable the debug user login by running the following command:

$ config vmuser disable

Vmuser access disabled

Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on Azure Platforms

If you have deployed the VA on Azure as a stand-alone virtual machine (VM) without a public IP address, you might experience intermittent DNS resolution issues when heavy DNS traffic is directed at the VA. This is due to SNAT port exhaustion on virtual machines deployed to Azure (such as the VA) because Azure only pre-allocates 1024 UDP ports for standalone VMs without a public IP address. To address this issue, you may either need to assign a public IP to each VA or deploy VAs behind a public Standard Load Balancer in Azure.

Note: If you are assigning a public IP to a VA, make sure that there are no inbound port rules for this VA that allow inbound access from the internet.

Troubleshoot Intermittent DNS Resolution Failures on a VA Deployed on non-Azure Platforms

Although less common, SNAT port exhaustion can also occur on virtual machines (VMs) deployed on non-Azure platforms. For more information, see Port Exhaustion When Using Port Address Translation with Umbrella components.

Troubleshoot DNS Resolution in Configuration Mode

The 'nslookup' command can be used to test DNS queries on the VA. This test reflects how a users' DNS lookups will be answered and is subject to internal domains routing and other processing on the VA.

You can specify a server IP address as a parameter for nslookup. This is useful for testing a Local DNS server or the Umbrella cloud directly. These tests bypass the VA software.

Troubleshoot DNS Resolution Failures Behind a Firewall

The VA offers DNScrypt functionality that protects the content of your DNS queries. This functionality may be blocked by your firewall.

If you are using the Cisco ASA firewall, you can see an indication of this in the ASA log.
For example:

Dropped UDP DNS request from inside:192.168.1.1/53904 to outside-fiber:18.252.251.720/53; label length 71 bytes exceeds protocol limit of 63 bytes

DNS resolution is not affected by this blocking, but your DNS queries are not fully protected. For more information, see Cisco ASA Firewall blocks DNSCrypt.

To address this, ensure that your firewall allows outbound queries on port 443 and 5353 for both TCP and UDP to the Umbrella for Government resolver IP addresses as mentioned in the Pre-requisites section.

SNMP Monitoring < Troubleshoot Virtual Appliances > Other Configurations

Updated about 2 months ago